CVE-2024-40766MalwarePublished 20 Oct 2025Updated 19 Nov 2025

SonicWall SonicOS · A view on a recent Salt Typhoon intrusion

Affects SonicWall SonicOSSource AlienVault OTX General

Authoritative record:CVE-2024-40766· Critical 9.3

Exploited in the wild · used in ransomware campaigns · KEV due 30 Sep 2024 · 18% EPSS : block it and hunt for it in your logs now.

Data as of 25 Oct 2026, 19:02 UTC

CVSS base score

9.3Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 30 Sep 2024 US federal agencies must patch by this date; a sensible deadline for everyone else.
Ransomware: Used in ransomware campaigns
EPSS: 18.3% chance of exploitation in 30 days – higher than 97% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 23 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 17 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE published
on cve.org
2024-08-2306:19Z, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
2024-09-09, 17 days after disclosure
In Threat Radar
record ingested
2024-09-1000:00Z, 18 days after disclosure
KEV remediation due
US federal deadline
2024-09-30, 38 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected software

Product	Affected	Fixed in
SonicWallSonicOS	Affected =5.9.2.14-12o and older versions =6.5.4.14-109n and older versions =7.0.1-5035 and older versions	Fixed in–

Description

Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.

Impact

Successful exploitation allows attackers to deploy a persistent backdoor (SNAPPYBEE) on Citrix NetScaler Gateway appliances, enabling command and control via LightNode VPS endpoints. The attackers can pivot within the network to Citrix VDA hosts, potentially leading to data exfiltration. The compromise threatens confidentiality and availability of targeted telecommunications infrastructure. However, early detection and containment prevented significant damage in the observed incident. No widespread exploitation is currently reported.

Defensive guidance

Organizations should prioritize proactive monitoring of Citrix NetScaler Gateway appliances for anomalous activity, especially related to DLL sideloading and unusual network communications. Apply vendor patches promptly once available. Early detection tools that use anomaly-based methods can be effective in identifying such intrusions. No known exploits are currently in the wild, reducing immediate urgency but maintaining vigilance is advised.

Summary

The Salt Typhoon group exploited a zero-day vulnerability identified as CVE-2024-40766 in Citrix NetScaler Gateway appliances. They employed DLL sideloading to install the SNAPPYBEE backdoor and used LightNode VPS endpoints for command and control communications. After initial compromise, the attackers pivoted to Citrix VDA hosts aiming to exfiltrate data. Detection was achieved early by Darktrace's anomaly-based methods, which allowed containment before major impact. There are currently no known exploits in the wild for this vulnerability. The attack highlights advanced tactics by a state-sponsored actor targeting telecommunications infrastructure.

CWE-284Improper Access Control (opens in a new tab)
Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
Attack patterns
Embedding Scripts within Scripts (opens in a new tab)
Modification of Windows Service Configuration (opens in a new tab)
Malicious Root Certificate (opens in a new tab)
Intent Spoof (opens in a new tab)
WebView Exposure (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Indicators of compromise

Domains 1

aar.gandhibludtric.com

URLs 8

http://137.184.126.86:8080/vmwaretools
http://156.244.28.153/17ABE7F017ABE7F0
http://89.31.121.101:443//Dialog.dat
http://89.31.121.101:443/DisplayDialog.exe
http://89.31.121.101:443/NortonLog.txt
http://89.31.121.101:443/dbindex.dat
http://89.31.121.101:443/imfsbDll.dll
http://89.31.121.101:443/imfsbSvc.exe

IP addresses 2

156.244.28.153
38.54.63.75

Hashes 3

8bd8506f6b1a80eea68e877fa81e267c
b5367820cd32640a2d5e4c3a3c1ceedbbb715be2
fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Jun 2026, 03:09 UTC

WeaknessesCWE-284

MITRE ATT&CK techniques6 from threat tags

Technical details